Insurance Broker Management Software in Dubai (2026): What the CBUAE Rules Now Force Your System to Do
Dubai brokers can no longer collect premium, cannot discount from their own commission, and must keep client data inside the UAE for ten years. Real AED build costs and what the CBUAE rules now demand.
- PUBLISHED
- 25 SEPT 2026
- READ TIME
- 11 MIN
- AUTHOR
- AQUARIUS · DUBAI
- UNIT
- REV 2026.09
Short answer: Insurance broker management software in Dubai is no longer a CRM choice — it is a licensing condition. Since the CBUAE Insurance Brokers’ Regulation 2024 came into force on 15 February 2025, a UAE broker may not collect premium from a client, may not discount by shaving its own commission, must keep client personal data inside the UAE with backups, retained at least ten years, and may not outsource activities offshore. A realistic custom build for a Dubai brokerage runs AED 120,000–450,000 depending on lines of business and insurer integrations, with hosting and support at 15–20% of build cost per year.
Here is what most Dubai brokerages get wrong. They treat the 2024 Regulation as a compliance memo for the legal folder, then keep running the business on a spreadsheet, a shared inbox and a CRM instance sitting in a European or American cloud region. Every one of those three things is now a finding waiting to happen. The rules did not just change what you are allowed to do — they changed where your data is allowed to live, who is allowed to hold the money, and how fast the commission has to land. Software is the only place those rules can actually be enforced.
The market got big enough that the regulator got serious
The UAE insurance sector wrote AED 74.8 billion in gross written premiums in 2025, up 14.9% from AED 65.1 billion in 2024. Inside that: property and liability at AED 36.4 billion (+14.1%), health at AED 30 billion (+16.3%), and life and fund accumulation at AED 8.4 billion (+12.1%). Policy count reached 17.3 million, with health policies alone growing 26.1% after mandatory basic health cover for private-sector employees and domestic workers took effect across the emirates on 1 January 2025.
It has not slowed down. CBUAE data for Q1 2026 shows gross written premiums up another 15.1% year on year and policies up 9.5%. Sector assets reached roughly AED 166.7 billion at end-2025 across 58 insurers. Policy volume is growing faster than any brokerage can hire, and the regulator now supervises a sector of that size — which is exactly the point at which supervision stops being polite.
What actually changed on 15 February 2025
The Insurance Brokers’ Regulation 2024 was issued on 25 July 2024, took effect on 15 February 2025, and expressly repealed the 2013 brokerage regulations. Four of its provisions rewrite how a brokerage’s systems have to work.
| What changed | The rule | What your software must now do |
|---|---|---|
| Premium collection | Collecting premium from the insured is the insurance company’s responsibility. Brokers may no longer collect premium for any line of business. | Remove premium-receipt workflows entirely. No client money ledger, no broker payment links. Quote and bind only. |
| Commission payment | Insurers must pay broker commission within ten business days of each transaction, or sooner if the brokerage agreement says so. | A receivables ledger that ages every commission against its own ten-business-day clock and flags breaches automatically. |
| Discounting | Brokers are prohibited from offering a discount by reducing their own commission. Any discount must come from the insurer. | Quote engine that cannot mathematically produce a below-schedule commission. Make the rule un-overridable, not a policy note. |
| Data and outsourcing | Personal data must be stored and maintained inside the UAE, with secure backups in a separate UAE location, retained at least ten years. Outsourcing activities outside the UAE is not permitted; material outsourcing needs CBUAE no-objection. | UAE-region hosting, UAE-region backup, ten-year retention schedule, and a vendor list you can defend. |
That last row is the one that quietly disqualifies most off-the-shelf stacks. A popular global broking CRM on a Frankfurt or Virginia region is not a configuration problem — it is a data-location problem you cannot fix with a setting. Same for an offshore back-office team keying endorsements, and for the backup copy nobody thought about. We covered the underlying question in our guide to website hosting and UAE data residency; for brokers, it is not a preference, it is the licence.
And then the law underneath it changed too
Federal Decree-Law No. 6 of 2025 was issued on 8 September 2025 and published in the Official Gazette on 15 September 2025, consolidating the Central Bank law, financial institutions and insurance business into one framework. Affected entities were given a one-year transitional period ending 16 September 2026 to bring operations into line.
That date has passed. Capital structures, governance models, claims-handling service levels and outsourcing arrangements designed around the old insurance law no longer carry over by default. And the ceiling moved: the maximum administrative fine under the new Central Bank law rose from AED 200 million to AED 1 billion, while carrying on a licensed financial activity without authorisation now draws imprisonment and/or a fine of not less than AED 50,000 and up to AED 500 million.
Enforcement is not theoretical. On 12 May 2025 the CBUAE imposed administrative and financial sanctions on five insurance brokers operating in the UAE — two financial penalties, three official warnings — for failures to comply with anti-money-laundering and counter-terrorist-financing requirements.
AML is worth pausing on, because it is the finding that most often arrives first. Brokers are supervised for AML and CTF, which means screening, risk rating, record-keeping and suspicious-transaction reporting through goAML have to be evidenced from a system, not reconstructed from memory during an inspection. Our note on AML and KYC compliance software in Dubai covers the reporting side in depth.
What a Dubai broker platform actually needs to contain
Strip away the vendor feature lists and a compliant brokerage runs on six modules. Everything else is decoration.
- Client and risk register. One record per client with KYC documents, Emirates ID and trade licence expiry, UBO data for corporates, and a risk rating that drives screening frequency. This is the AML backbone and the CRM at the same time.
- Quote and placement. Structured submission out to insurers, quotes back in, side-by-side comparison, and a commission schedule the user cannot edit downward. Bilingual output too — a large share of UAE policyholders want the Arabic version, and Arabic is not a translation layer bolted on at the end.
- Policy lifecycle. Binding, endorsements, mid-term adjustments, cancellations and — the one that pays for the whole system — renewals. Every policy carries its own clock: 90-day, 60-day, 30-day and 7-day renewal triggers, assigned to a named producer.
- Commission receivable ledger. Per transaction, per insurer, with the ten-business-day rule applied automatically and an exception queue for anything that ages past it. This is now a regulatory control, not an accounting nicety.
- Claims tracking. Brokers do not settle claims, but they are judged on how they shepherd them. First notification, document chase, insurer service-level tracking and a client-visible status trail.
- Compliance and audit log. Immutable event history, ten-year retention, UAE-resident storage, exportable in the shape a supervisor asks for rather than the shape your database happens to be in.
One decision that is not a module: medical is a different animal. Group schemes mean census files, member-level enrolment and mid-year additions and deletions — per-member admin no other line produces, which is why health policy counts grew 26.1% while brokers’ headcounts did not. If medical is more than a quarter of your book, build census handling first.
Buy, configure or build: the real trade-off in Dubai
Global broking platforms are mature and genuinely good. The problem is that their defaults were written for the UK, US or Australian market, and two of their assumptions are now illegal here: broker-held client money, and data hosted wherever the vendor’s region list happens to put it. You can sometimes negotiate a UAE region. You can rarely negotiate a UAE backup region as well, and almost never get a contractual answer on where support staff sit — which matters, because outsourcing activities outside the UAE is not permitted.
| Option | Indicative cost (AED) | Time to live | Where it breaks |
|---|---|---|---|
| Generic CRM configured for broking | 25,000–90,000 setup plus per-user licences | 4–8 weeks | Data residency and backup location; no commission-ageing logic; renewals become manual tasks |
| International broking platform, UAE-hosted tenant | Licence-led, typically six figures annually at scale | 3–6 months | Residency of backups and support staff; local commission and discount rules need customisation you do not control |
| Custom core platform, UAE-hosted, single line of business | 120,000–200,000 | 10–14 weeks | Scope creep into every line at once |
| Custom multi-line platform with insurer integrations | 250,000–450,000 | 4–7 months | Insurer API readiness varies wildly; budget for file-based fallbacks |
| Client and corporate HR self-service portal (add-on) | 45,000–110,000 | 4–8 weeks | Worth it only once group medical volume justifies it |
| Annual hosting, support and compliance maintenance | 15–20% of build cost per year | Ongoing | Under-budgeting this is how good systems rot |
One honest caveat on insurer integrations: in the UAE they are uneven. Some insurers offer clean APIs for motor and medical quotes; plenty still run on rated spreadsheets and email. Any credible plan budgets for both, and treats a file-based connector as a first-class feature rather than a temporary hack — because it will not be temporary. The same build discipline applies on the consumer-facing side, which we cover in our piece on insurance comparison website development in Dubai.
The number that actually decides the business case
Compliance is the reason you must act. Renewals are the reason it pays. A brokerage’s renewal book is its entire enterprise value, and renewals leak through exactly one mechanism: nobody was told in time. A system that fires a 90-day renewal trigger against a named producer, with the previous year’s premium and claims history attached, converts at a rate no inbox can match — and the arithmetic is unforgiving. On a book of 1,000 policies at an average AED 4,000 premium and a 12% commission, every single percentage point of retention you recover is roughly AED 4,800 of annual commission you keep without writing a single new client. Five points is AED 24,000 a year, recurring, on a system you pay for once.
Against that, price the downside honestly. The administrative fine ceiling is now AED 1 billion. The paid-up capital you have already posted is AED 3 million, alongside a AED 3 million bank guarantee for the head office and AED 1 million per branch, with at least 51% UAE national ownership and annually renewed professional indemnity cover naming the Central Bank as beneficiary. That capital is not at risk from a bad quarter. It is at risk from a supervisory finding that your client data sat outside the UAE, or that your firm collected a premium it was no longer allowed to touch.
How Aquarius builds these
We build broker platforms UAE-first: hosted in a UAE region with a separate UAE backup location, a ten-year retention schedule written into the data model rather than promised in a policy document, an audit log that is append-only, and commission logic where the ten-business-day clock and the no-self-discount rule are enforced in code. Arabic and English from day one. Insurer connectors built API-first with file-based fallbacks, because that is the market you actually operate in. Data-protection obligations are handled alongside the Regulation, not after it — see our UAE PDPL compliance checklist.
We start with a two-week discovery that maps your current lines of business, insurer panel and data locations against the Regulation, and produces a fixed-scope build plan before anyone writes code. If the honest answer is that a configured platform gets you there for less, we will tell you that — it happens, usually for single-line motor brokerages. See our pricing for how we structure engagements and the services we bring around a build.
FAQ
Can a Dubai insurance broker still collect premium from clients?
No. Under the CBUAE Insurance Brokers’ Regulation 2024, in force since 15 February 2025, collecting premium from the insured is the insurance company’s responsibility, and brokers may no longer collect premium for any line of business. Any software workflow that takes client money needs to be removed, not disabled.
Where must a UAE broker’s client data be stored?
Inside the UAE. The Regulation requires personal data to be stored and maintained within the country, with secure backups held in a separate location also inside the UAE, retained for at least ten years. Outsourcing activities outside the UAE is not permitted, and material outsourcing requires CBUAE no-objection.
How quickly must an insurer pay broker commission?
Within ten business days of each transaction, unless the brokerage agreement specifies a shorter period. Brokers are also prohibited from offering discounts by reducing their own commission — any discount must come from the insurance company.
What does insurance broker software cost in Dubai?
A configured generic CRM starts around AED 25,000–90,000 plus per-user licences but rarely satisfies residency and commission rules. A custom single-line platform runs AED 120,000–200,000; a multi-line platform with insurer integrations runs AED 250,000–450,000. Budget 15–20% of build cost annually for hosting, support and compliance maintenance.
What happened on 16 September 2026?
That was the end of the one-year transitional period under Federal Decree-Law No. 6 of 2025, which consolidated the UAE’s Central Bank, financial institutions and insurance framework. Arrangements built around the old insurance law — governance, outsourcing, capital structures, claims service levels — no longer carry over by default, and the maximum administrative fine is now AED 1 billion.
The short version
A brokerage’s systems used to be an efficiency question. Since February 2025 they are a licensing question with an efficiency bonus attached. Data location, premium handling, commission timing and retention are all now things a supervisor can ask you to demonstrate, and the only honest way to demonstrate them is from a system that was built to enforce them.
If you are running a Dubai brokerage on a CRM you inherited and a folder structure you inherited, the cheapest hour you will spend this quarter is the one where someone maps them against the Regulation. Send us your current stack and lines of business and we will do that mapping with you.